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ABSTRACT 

Health diagnostics is an area where major improvements have been identified for potential implementation into the design of 
new reusable launch vehicles in order to reduce life cycle costs, to increase safety margins, and to improve mission 
reliability. NASA Ames is leading the effort to develop inspection and health management technologies for thermal 
protection systems. This" paper summarizes a joint project between NASA Ames and SRI International to develop 
"SensorTags," radio-frequency identification devices coupled with event-recording sensors, that can be embedded in the 
thermal protection system to monitor temperature or other quantities of interest. Two prototype SensorTag designs 
containing thermal fuses to indicate a temperature overlimit are presented and discussed. 
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1. INTRODUCTION 

Commercialization of a competitive reusable launch vehicle (RLV) to replace the aging Space Shuttle fleet is a primary goal 
for both NASA and the US aerospace industry. 1 " 2 To expedite achievement of this goal, NASA is funding development of 
innovative technologies to lower cost and to increase safety and reliability for access to space. One area where significant 
improvements are required is vehicle ground operations. Compared with current Shuttle procedures, ground operations for 
future RLVs need lower personnel costs as well as much faster turnaround time, because flight frequency is a critical life- 
cycle cost (LCC) factor. Vehicle turnaround in days, rather than months, is the goal for the next-generation RLV. 

Ground operations for the thermal protection system (TPS) are estimated to account for between 25% and 30% of the LCC 
for the Shuttle fleet (assuming a 100-mission life). Current procedures rely on humans to perform a detailed close-range 
visual inspection of the entire exterior surface, identifying defects and dimensioning them as required for disposition (ignore, 
repair, replace) using measurement aids such as rulers, micrometers, and depth gauges/ The most time consuming and 
tedious activity is micro-inspection of the gaps between over 20,000 tiles. Tiles experience the highest temperatures during 
entry and may shrink slightly; this shrinkage can open high-tolerance gaps and require insertion of a gap filler during 
maintenance. Furthermore, because tiles shake and jostle during flight, inter-tile gaps may open and close, and gap fillers 
can fall out. Penetration of hot gas into any gap can char gap fillers, organic adhesives, and felts used as strain isolation 
pads. Inspectors must look at every gap for the presence and quality of the gap filler, out-of-tolerance gaps, and any evidence 
of hot gas inflow, which may necessitate a TPS removal to check for subsurface damage. 

Non-destructive evaluation (NDE) technology is expected to make future TPS inspection activities more automated, more 
reliable, and quicker than human inspections. Figure 1 shows a futuristic concept of pre-flight TPS inspection operations for 
an RLV. 4 A large portal is used to scan the entire vehicle, inspecting the exterior surface for damage and querying a suite of 
subsurface health sensors to confirm their operational status. 5 Alternative concepts to accomplish the same objective from a 
closer distance are: automated scanning heads that can cover the surface of vehicle, or a set of small light-weight robots that 
can walk around the vehicle surface (possibly doing repairs as required). The robots would be useful for in-space inspection 
and repair of a vehicle docked at the International Space Station. In any case, the surface inspection probably will utilize a 
combination of a smart color vision system, a 3-D laser measurement tool, and pattern recognition software. The subsurface 
sensor data would be acquired using wireless communication from the individual sensors or from the vehicle. The scan 
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results are compared with a historical database of internal sensor and surface data to assess the health and launch readiness of 
the vehicle. Ail anomalies are noted, and if none require immediate attention, the vehicle may proceed to launch. The same 
system can be used for post-flight inspection and download of flight sensor data. Owing to NASA's goal for rapid vehicle 
turnaround for the next-generation RLV, the entire scanning operation must be completed in a fraction of a day, preferably 
only one or two hours. 

NASA Ames has been identified as the lead center to develop TPS inspection and health management technologies. To this 
end, cooperative research is being carried out with various industry partners and other NASA centers to develop in parallel 
both optical surface inspection technology and subsurface sensors technology. In both case’s, although the inspection system 
eventually will be fully automated, portable handheld inspection tools will be developed for near-term applications involving 
human inspectors. These handheld tools will be less costly for sensor system development and testing, and they can be used 
on the Shuttle to assist in meeting a goal to complete ground operations in 30 days. This paper summarizes development 
efforts by NASA Ames and SRI International for subsurface TPS health sensors. 4 ' 7 The optical surface scanning system will 
be the subject of a different paper. 

2. REQUIREMENTS DEFINITION 

Once the drive-through inspection portal concept (Figure 1) was identified as a long-term goal, a list of system requirements 
for remote automated inspection technology for TPS was developed cooperatively by TPS and sensors experts and operations 
personnel at Kennedy Space Center (KSC). The primary requirements are: 

1 . Must provide rapid inspection for fast vehicle turnaround. 

2. Must carry out the inspection with high reliability and reproducibility. 

3. Development and implementation costs must be reasonable (use off-the-shelf technology where possible). 

4. Must be safe for humans and vehicles (preferably remote). 

5. No excessive database or data processing requirements. 

6. Should be applicable to all TPS to minimize the number of systems required. 

7. Should be easily integrable into an overall integrated vehicle health management (IVHM) system. 

For TPS subsurface sensors, the following requirements were added: 

8. Must be sufficiently small and lightweight. 

9. Must not adversely impact the TPS thermal or mechanical performance. 

1 0. Insertion must have minimal impact on TPS manufacturing costs. 

1 1 . Lifetime must exceed TPS lifetime, or design must allow easy replacement and maintenance. 

12. Communications must be wireless. 

Most of these requirements are straightforward. The first two are driven by NASA's goals for cost, safety, and reliability. 
The third is driven by budget constraints as well as NASA’s timeline to have fully demonstrated technology for the next- 
generation RLV by the year 2005. 

The TPS presents special difficulties and requirements for instrumentation. The TPS consists of tens of thousands of 
separate parts that are independently bonded to an underlying structure and independently replaceable in case of damage. To 
monitor the health of every significant part will require tens of thousands of sensors (50,000 on a large vehicle is not 
unrealistic), however the sensors and the data acquisition system need to have minimal overall mass and volume impact on 
the vehicle. Therefore, the average mass per sensor should be only a fraction of a gram. Furthermore, the sensor data 
collection system cannot rely on wiring (metallic, fiber optic) between parts, not only because of the mass penalty of 
extensive wiring but also because of the difficulty in locating and repairing damaged wires. TPS components are designed 
to last from tens to hundreds of flights and (ideally) should not be replaced except as required owing to damage such as a 
debris impact hole. Subsurface instrumentation must have a longer lifetime than the TPS, because sensors will not be 
allowed to drive the TPS replacement schedule. Finally, the sensors also must survive adverse environmental conditions, 
most notably temperature extremes that can vary from sub-zero (possibly near-cryogenic) lows to over 1 100°C at the surface. 

3. TECHNICAL APPROACH 

In consideration of the formidable requirements for instrumentation, in particular the need to collect sensor data without use 
of extensive wiring, our initial concept is to forgo an onboard data acquisition system and instead rely on the external portal 
or portable reader to collect data directly from the subsurface sensors. The sensors will be mutually independent. Each 



sensor is attached to a radio-frequency-tuned circuit containing a radio-frequency identification (RFID) microchip. This 
device is called a "SensorTag" because the microchip tags the circuit with a unique identification number. Figure 2 shows a 
functional block diagram for the SensorTag system, consisting of an external macro-reader and any number of SensorTag 
micro-devices. 3 The reader radiates sufficient radio-frequency power to energize the SensorTag circuit. The SensorTag 
rectifies this power to recall an identification number from the microchip's memory, and the ID number and sensor data are 
transponded back to the reader. The sensor data may be the current state of the sensor (e.g., are you still waterproofed?), a 
previously recorded sensor state (e.g., the maximum temperature measured during this mission), or a detailed profile of 
flight data. A microbattery optionally could be used to provide power for in-flight data acquisition and to assist on-ground 
data transmission. To conserve power the sensor circuit probably would be a "sleep" mode unless the circuit is actively 
taking data or being aroused by the reader. Unfortunately, the state-of-the-art in microbatteries is not sufficiently advanced: 
the mass and volume are too large, and lifetime is too short, to satisfy requirements 8 and 11. Therefore, microbattery 
assisted SensorTags can be used only in special cases at this time. 

One important question to answer is whether or not wireless communication at standard RF frequencies is effective through 
TPS materials and in the presence of standard adhesives and a metal or composite substrate. A testbed was assembled, and 
demonstrations using current off-the-shelf technology showed that RF communication was feasible through commonly used 
types of TPS tiles and blankets. Using "rice-grain "-sized commercial RFID tags and a small reader (Figure 3), a read range of 
about 10 cm from the sensor was observed with variations of about 10% depending on the combinations of materials being 
tested. The read range needs to be increased significantly, because in some applications the TPS may be 10.2-cm thick, but 
there appears to be no fundamental problem using RF communications to and from subsurface sensors. 

The other major communications issue is the speed with which sensors can be read. A "wing-shaped" demonstration article 
(Figure 4) was assembled with over one hundred RFID tags beneath a TPS blanket and tiles. The reader is a 7" square coil. 
The RFID microchips and reader utilize "anti-collision" technology to enable communications with multiple tags of the 
same type. The demonstration shows that communication with all tags easily can be accomplished in less than one minute 
from a distance of over 30 cm. The implication for an RLV is that multiple readers or receiving stations may be needed to 
read tens of thousands of sensors. If the overall power requirement, anti-collision capability, or read range are a problem at 
the length scale of a large portal, the use of moving scan heads or robots that can get closer to the vehicle surface should 
mitigate these problems. It should also be noted that to lower cost, this demonstration utilized 125-kHz microchips and 
tuned RF circuits that have a relatively low data transfer rate. Significantly faster communications may be possible using 
RFID components that operate at higher frequencies such as 13.56 MHz. 

4. PROTOTYPE DEVICES 

A review of Shuttle inspection operations identified several potential applications of TPS health sensors such as monitoring 
internal temperatures, measuring the burnout depth of waterproofing agents, and detecting impact by micrometeorites or 
orbital debris. The detection of overheating in inter-tile gaps received the highest priority from KSC operations personnel. 
Therefore the initial focus of this work became to develop a SensorTag suitable for detecting excessive temperatures in gaps 
and small enough to allow testing on the Space Shuttle. Owing to the limitations of microbatteries discussed previously, 
these SensorTags will be passive devices that do not require batteries. 

Figure 5 provides a cross-sectional view of the geometry. The TPS tile thickness varies from 2.6 to 10.2 cm, and inter-tile 
gaps nominally vary from 0.08 to 0.13 cm. On reentry from orbit, hot gas penetration into the gap can char the filler bar, 
RTV bond, and felt SIP. If this subsurface damage is not detected and repaired, a tile may detach on the next flight, 
resulting in severe damage to the vehicle structure. The ideal place to locate a thermal sensor is at the bottom of the gap or 
in the filler bar strip that is placed down before tiles are installed. For a major Shuttle retrofit, sensors could be pre-installed 
every 5-10 cm inside the filler bar to monitor temperatures all over the vehicle. In any case, exposure to a temperature above 
about 290°C will char the subsurface components. The sensor needs to indicate the occurrence of this temperature. 
Furthermore, to reliably record and report this over-temperature event, the circuit should be capable of withstanding short- 
term exposure to temperatures of 345°C or higher. In this application, the SensorTag needs an indefinite lifetime but does 
not need to be reusable. An over-temperature event will necessitate a TPS disassembly for subsurface inspection and repair, 
and a new SensorTag can be installed during the TPS reassembly. 

The constraints of the geometry dictate a "rice-grain" sensor shape similar to the sensor shown in Figure 3 . Figure 6 is an 
image of the prototype SensorTag that was manufactured in 1999. 6 This design was assembled on a circuit-board substrate 
from mostly off-the-shelf products. The main components are a ferrite rod, insulated copper wire, two capacitors, a silicon 
microchip, and a thermal fuse. Most of the components can survive prolonged exposure to 200°C except that the thermal 
fuse opens at 187°C. The SensorTag circuit (Figure 7) incorporates the two tuning capacitors. Initially the fuse is closed, 



and the resonant frequency of the device is determined by the parallel combination of the two capacitors. If the fuse opens, 
the fuse capacitor is removed from the circuit, and the resonant frequency of the circuit increases. The low frequency 
resonance is at 103 kHz, and the high frequency resonance is at 156 kHz. This design leverages the commercial RFID 
technology operating at 125 kHz. The frequency separation is sufficient to provide discrimination between the two sensor 
states when the quality factor of the resonant circuit is sufficiently high. Figure 8 shows this frequency discrimination 
capability for a quality factor of 35. According to this figure, at read ranges of 10 to 14 cm, the SensorTag device will 
respond only when queried near the correct frequency (either 103 kHz or 156 kHz). However, for short read ranges (e.g. 5 
cm) SensorTags will respond to interrogation at either frequency. This ambiguity can be corrected by a more sophisticated 
reader design in which the reader compares the amplitudes of the communications at each frequency and arbitrates the sensor 
state based on the strongest reply. This frequency-shift design is best implemented in a single reader that alternates 
interrogation pulses between 103 kHz and 156 kHz at a rapid rate. 

Encapsulation can be used to protect the SensorTag from the environment and from mishandling. Commercial RFIDs are 
often encased in glass; unfortunately, the mass and thickness of glass encapsulation are undesirable for our application. To 
provide some protection from mishandling during testing, the 1999 SensorTags were wrapped in a Kapton polyimide sleeve 
that was open to the environment on both ends. 

The encapsulated SensorTags were subjected to heating tests at SRI International and to Arc Jet heating tests at NASA 
Ames. The primary purpose of the testing at NASA was characterization of heating in inter-tile gaps with varying widths 
and orientation to the flow in simulation of X-34 flight conditions. The X-34 is a winged rocket vehicle that will have tile 
leading edges. Figure 9a shows a 5-cm thick, alumina-enhanced thermal barrier (AETB) tile that was sectioned and coated. 
The sectioned tile was instrumented with many thermocouples set at various heights within the gaps (Fig 9b), placed in a 
test panel (Fig 9c), and exposed to a series of increasing heating conditions. For several of the tests, SensorTags were placed 
at the bottom of various gaps at the base of the panel. The results of both the oven and Arc Jet testing verified the 
performance of the SensorTag design as follows: 

• If the fuse temperature is not exceeded, the circuit transponds at 103 kHz. 

® If the fuse temperature is exceeded, the circuit transponds at 156 kHz. 

• However, if the temperature exceeds about 200°C, the SensorTag is destroyed. 

The work performed in 1999 showed the viability of the SensorTag concept. Work in 2000 focused on more rigorously 
meeting the requirements for size, mass, and temperature capability. 7 Figure 10 is an image of the 2000 SensorTag. The 
main components are a ferrite rod, insulated copper wire, one capacitor, a silicon microchip, and a microfuse. The lateral 
dimension of 0.12 cm allows insertion into larger gaps as well as installation into the filler bar. Although the bare 
SensorTag can be handled with care (use of gloves is recommended), we are considering use of SRI's preceramic polymer 
coating to provide more durability and environmental protection. The tag can be dipped in the polymer solution, and used 
as is or cured in an oven at 130°C if required. The cured ceramic is tougher and lighter than the polymer. The polymer is a 
hydrophobic, low-loss dielectric. A thin film with negligible mass provides waterproofing as well as protection from oils 
and salts. 

The 2000 SensorTag uses the MCRF202 chip manufactured by Microchip Technologies. This device includes a switch port 
that enables the circuit design shown in Figure 1 1. When the switch is closed (fuse intact), the RFID transponds its normal 
ID code that is usually between 64 and 256 bits long. When the switch is open (fuse blown owing to over-temperature) the 
RFID transponds a bit-inverted ID code. The difference between these two states is easily detected. This implementation 
overcomes the need for a reader that operates at two separate frequencies and also eliminates the ambiguity that can occur 
with the frequency-shift design for short read range or low-quality-factor resonators. 

An EEPROM-based microchip, such as the MCRF202, may suffer data retention difficulties with prolonged exposure to 
high temperatures. The usual method for characterizing data retention is to program a device and bake it at an elevated 
temperature. Device failure rates as a function of exposure time enable the estimation of data retention lifetimes at lower or 
higher temperatures using an acceleration factor. This acceleration factor is typically described by an Arrhenius relationship. 
In some cases, a final processing step of the programmed devices is performed at 450°C for 30 minutes. This screening 
indicates that exposure to 315°C for 15-20 minutes, or possibly as long as several hours, should not be a problem for data 
retention. If repeated survival at higher temperatures is needed, a PROM-based device would be preferred. 

Figure 12 is a sketch of the microfuse geometry. The microfuse design included selection of a fuse material, construction of 
a geometry that satisfies electrical, spatial, thermal, and mechanical constraints, and design of a housing to enclose both the 
microfuse and the flux needed to activate the solder. Eutectic solders, because of their precise melting points, are a good 



choice for use as the fuse material. The commercially available solder that best met our requirements was a Pb-Ag-Sn solder 
that melts at 292°C. The solder strip dimensions (50pm x 75pm x 400pm) are consistent with the width of the SensorTag 
and allow room for the cover. The strip resistance is much lower than 1 ohm and will not degrade the quality factor of the 
circuit. Order-of-magnitude calculations indicate there should be no serious mechanical difficulties from acceleration, 
vibration, or thermal expansion. Additionally, the thermal response of the fuse is much faster than alumina substrate, so 
thermal response of the SensorTag is dominated by conduction to the substrate. Heating tests confirm that the solder balls 
rapidly with short-term exposure above the melting point. The cover protects the fuse from damage, contains the flux 
needed to activate the solder, and prevents molten solder from shorting out the circuitry. 

To confirm temperature capabilities and SensorTag thermal performance, hot plate and oven tests were performed on the 
SensorTag components and on partially and fully-assembled SensorTags. The test results indicate: 

• 1 5 minutes at 285°C: normal performance, no problems encountered. 

• 1 5 minutes at 3 1 5°C: some darkening of non-conductive epoxy, microfuse balls as expected. 

• 15 minutes at 345°C: epoxy turned black, polyimide darkens. 

® 15 minutes at 370°C: polyimide insulation is quite dark. No change in read range after cooling. 

• 15 minutes at 400°C: polyimide is black. No change in read range after cooling. 

We were concerned that heating the ferrite rod above the Curie temperature (reported as 350°C) where magnetic properties 
degrade would reduce the read range, however the results indicate that either the Curie temperature is higher than reported or 
the permeability is restored when the rod is cooled. 

Figure 13 summarizes the temperature capabilities of the 1999 and 2000 SensorTags. For the 2000 SensorTag, many 
components exceed the temperature requirements. The alumina substrate will survive temperatures in excess of 1600°C. 
The capacitor, a ceramic, has been used in devices operating up to 400°C. Temperature tests of the ferrite rod up to 400°C 
indicate that its permeability characteristics are not significantly degraded. The polyimide wire insulation begins to darken 
above 350°C, but can be used for brief time periods up to 400°C. The copper wire has a melting point above 1000°C. The 
EEPROM-based microchip may suffer data retention difficulties with repeated prolonged exposure to high temperatures, 
hence the shaded area in the figure. Many adhesives decompose above 350°C, but short-term survival tests of the 
SensorTags show that brief exposure to 400°C does not compromise the room temperature performance of the device. 
Finally, SRI preceramic polymer encapsulation has been tested to 400°C. These component capabilities point to the 
possibility of constructing a fiiture SensorTag capable of short-term survival to 400°C or even 450°C reenby temperatures if 
required. 

5. FUTURE WORK 

The 2000 SensorTag design achieved the required RLV goals for mass, size, and temperature capability. Some mass 
reduction is possible by eliminating excess space on the alumina subtrate. Issues that remain are data transfer rate, read 
range, cost, and reliability. Reader design and software for improved read range and faster communications are discussed in 
Reference 7. We would prefer to use a low power (<10 jiW) PROM-based 13.56 MHz chip with anti-collision architecture 
when a suitable device becomes available. Operation at 13.56 MHz will allow faster communications, greater read range, 
and further size reduction to below 0.08 cm, if required, using a 0.05-cm dielectric rod in the core of the microantenna. 

A reliability goal of only one failure every 1-5 missions, with up to 50,000 Sensortags on a vehicle, implies a 4-sigma to 6- 
sigma quality standard. Such reliability cannot be expected from hand-assembled prototype SensorTags, but may be 
possible in industrial mass production. At this point, the main weakness of the design appears to be microfuse performance. 
More work is needed to insure that flux remains on the solder regardless of thermal cycling, vibrations, and accelerations that 
can occur on a reusable launch vehicle. 

With such a large number of SensorTags, a few will experience data retention difficulties. In fact, exposure to radiation in 
the space environment is known to introduce single-event upsets. 8 Although the radiation dosage is fairly low in typical 
Shuttle orbits, these improbable random events do happen; however, the errors are most likely to occur in only one bit per 
SensorTag. Suitable error-correcting codes, such as. Hamming codes, can be used to encode the ID number so that the 
SensorTag will be immune to one (or more) bit upsets. 9 

SensorTag development continues both in an effort to extend the capabilities for over-temperature indication and the 
integration of additional event-recording sensors (such as strain). Other applications of SensorTag technology include health 



monitoring of expensive structures, such as monitoring of highway bridge decks for chloride ingress, and commercial 
applications, such as monitoring tires for over-temperature or under-inflation conditions. 

MEMS-based sensors would be ideal candidates for use in SensorTags in RLVs if they can meet size and temperature 
requirements. In particular, a MEMS device that could remember the highest temperature encountered, and then be reset by 
command from an external reader, could be used all over the vehicle structure to provide quantitative information on TPS 
performance and bond health. One possibility is a device with multiple states in a circular structure that could report the 
maximum temperature to the reader as the difference between the initial and fmal positions. Reset occurs in the reader by 
updating the sensor position in its memory prior to the next RLV mission. 


6. SUMMARY 

Issues and requirements for NDE health monitoring of thermal protection systems on future reusable launch vehicles were 
discussed. NDE technology is expected to make future inspection activities more automated, more reliable, and quicker than 
human-inspection procedures currently being used on the Space Shuttle fleet. Cooperative research between NASA Ames 
and industry partners is being carried out to advance both optical surface inspection technology and wireless subsurface 
sensor technology. NASA Ames and SRI International are participating in a joint project to develop "SensorTags," radio- 
frequency identification devices coupled with event-recording sensors, that can be embedded in the thermal protection system 
to monitor temperature or other quantities of interest. Two prototype SensorTag designs containing thermal fuses to indicate 
a temperature overlimit were presented and discussed. 
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Figure 1. Futuristic TPS inspection process 
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Figure 2. SensorTag system block diagram 



Figure 3. Demonstration of communication through various TPS Figure 4. Demonstration of rapid communication with many 

materials to Biomark RFID tags (insert 73 mg) at 125 kHz. RFID tags at 125 kHz using anti-collision technology. 
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Figure 5. Cross-sectional view of typical Space Shuttle TPS stackup showing intended placement of thermal SensorTag (not to scale). 
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Figure 6. First prototype SensorTag, manufactured in 1999 (not encapsulated), 3 13 mg. 
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Figure 7. Circuit diagram for 1999 SensorTag. This circuit uses 
a resonant-frequency shift to communicate a change in the sensor 
(fuse) state. 
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Figure 8. Theoretical frequency response of SensorTags at 
different resonant frequencies (assuming a circuit quality 
factor of 3 5). 



Figure 9. Test model for 1999 SemsorTags: (a) sectioned AETB tile, rear view, (b) model instrumented with 40 thermocouples, rear 
view (c) model installed in Arc Jet test facility, front view. The arrow in (c) shows the flow direction of the hot gas. 
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Figure 10. Second prototype SensorTag, manufactured in 2000 (not encapsulated), 80 mg. 
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Figure 11. Circuit diagram for 2000 SensorTag. This circuit 
uses bit-stream inversion of the ID tag to communicate a change 
in fie sensor (fuse) state. 


Figure 12. Thin-film microfuse design: (a) top view of 
uncovered microfuse on alumina substrate, (b) side view of 
covered microfuse (closed circuit), (c) side view of covered 
microfuse (open circuit). The cover provides sufficient space 
for the solder to bead upon melting, thereby opening the circuit 



Figure 13. Comparison of 1999 and 2000 SensorTag component 
survival temperatures (not to scale). 








